Skip to content

Commit d1e7334

Browse files
committed
Remove ExpressionLanguage reference for 2.3 version
Remove "Using Expressions for Complex Security Restrictions" section using ExpressionLanguage in 2.3 version. ExpressionLanguage is a 2.4 feature.
1 parent 9d599a0 commit d1e7334

File tree

1 file changed

+0
-85
lines changed

1 file changed

+0
-85
lines changed

best_practices/security.rst

Lines changed: 0 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -121,89 +121,6 @@ Using ``@Security``, this looks like:
121121
// ...
122122
}
123123
124-
Using Expressions for Complex Security Restrictions
125-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
126-
127-
If your security logic is a little bit more complex, you can use an `expression`_
128-
inside ``@Security``. In the following example, a user can only access the
129-
controller if their email matches the value returned by the ``getAuthorEmail``
130-
method on the ``Post`` object:
131-
132-
.. code-block:: php
133-
134-
use AppBundle\Entity\Post;
135-
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
136-
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
137-
138-
/**
139-
* @Route("/{id}/edit", name="admin_post_edit")
140-
* @Security("user.getEmail() == post.getAuthorEmail()")
141-
*/
142-
public function editAction(Post $post)
143-
{
144-
// ...
145-
}
146-
147-
Notice that this requires the use of the `ParamConverter`_, which automatically
148-
queries for the ``Post`` object and puts it on the ``$post`` argument. This
149-
is what makes it possible to use the ``post`` variable in the expression.
150-
151-
This has one major drawback: an expression in an annotation cannot easily
152-
be reused in other parts of the application. Imagine that you want to add
153-
a link in a template that will only be seen by authors. Right now you'll
154-
need to repeat the expression code using Twig syntax:
155-
156-
.. code-block:: html+jinja
157-
158-
{% if app.user and app.user.email == post.authorEmail %}
159-
<a href=""> ... </a>
160-
{% endif %}
161-
162-
The easiest solution - if your logic is simple enough - is to add a new method
163-
to the ``Post`` entity that checks if a given user is its author:
164-
165-
.. code-block:: php
166-
167-
// src/AppBundle/Entity/Post.php
168-
// ...
169-
170-
class Post
171-
{
172-
// ...
173-
174-
/**
175-
* Is the given User the author of this Post?
176-
*
177-
* @return bool
178-
*/
179-
public function isAuthor(User $user = null)
180-
{
181-
return $user && $user->getEmail() == $this->getAuthorEmail();
182-
}
183-
}
184-
185-
Now you can reuse this method both in the template and in the security expression:
186-
187-
.. code-block:: php
188-
189-
use AppBundle\Entity\Post;
190-
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
191-
192-
/**
193-
* @Route("/{id}/edit", name="admin_post_edit")
194-
* @Security("post.isAuthor(user)")
195-
*/
196-
public function editAction(Post $post)
197-
{
198-
// ...
199-
}
200-
201-
.. code-block:: html+jinja
202-
203-
{% if post.isAuthor(app.user) %}
204-
<a href=""> ... </a>
205-
{% endif %}
206-
207124
.. _best-practices-directy-isGranted:
208125

209126
Checking Permissions without @Security
@@ -349,13 +266,11 @@ develop `your own user provider`_ and `your own authentication provider`_.
349266

350267
.. _`Security Cookbook Section`: http://symfony.com/doc/current/cookbook/security/index.html
351268
.. _`security.yml`: http://symfony.com/doc/current/reference/configuration/security.html
352-
.. _`ParamConverter`: http://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/annotations/converters.html
353269
.. _`@Security annotation`: http://symfony.com/doc/current/bundles/SensioFrameworkExtraBundle/annotations/security.html
354270
.. _`security.yml`: http://symfony.com/doc/current/reference/configuration/security.html
355271
.. _`security voter`: http://symfony.com/doc/current/cookbook/security/voters_data_permission.html
356272
.. _`Acces Control List`: http://symfony.com/doc/current/cookbook/security/acl.html
357273
.. _`ACL's`: http://symfony.com/doc/current/cookbook/security/acl.html
358-
.. _`expression`: http://symfony.com/doc/current/components/expression_language/introduction.html
359274
.. _`FOSUserBundle`: https://github.com/FriendsOfSymfony/FOSUserBundle
360275
.. _`Remember Me feature`: http://symfony.com/doc/current/cookbook/security/remember_me.html
361276
.. _`impersonate users`: http://symfony.com/doc/current/cookbook/security/impersonating_user.html

0 commit comments

Comments
 (0)